@awesomate/hosting-mcp 0.73.0 → 0.74.0

package/dist/index.js

@@ -41415,7 +41415,7 @@ function restartGuidance() {
 var SERVER_INSTRUCTIONS = [
   "Awesomate connects this account's WordPress hosting, n8n automations, apps and Knowledge Base to Claude.",
   "Entry point: call awesomate_get_context once per session FIRST \u2014 it returns the account, plan, limits, an `attention` digest (unread notifications, erroring workflows, token expiry) and skill freshness. The domain contexts (awesomate_n8n_context, awesomate_app_context, awesomate_knowledge_status) come after it, only for their domain.",
-  "The awesomate-* skills are installed on this machine \u2014 load the one matching the task (awesomate-hosting, awesomate-n8n, awesomate-app-builder, awesomate-knowledge, awesomate-seo, awesomate-credentials, awesomate-github, awesomate-database, awesomate-support, awesomate-email) before working in that area.",
+  "The awesomate-* skills are installed on this machine \u2014 load the one matching the task (awesomate-hosting, awesomate-n8n, awesomate-app-builder, awesomate-knowledge, awesomate-seo, awesomate-credentials, awesomate-github, awesomate-database, awesomate-support, awesomate-email, awesomate-onebrain for 1Brain) before working in that area.",
   "Reads work on every plan; building/writing generally needs Support Plus or above, and the Knowledge Base is on every plan (media and OCR ingest need Pro, a public widget and Ingestion Packs need Support Plus). Never retry a 403: it carries either an upgrade path (relay it honestly, let the user decide) or a privacy toggle only the user can flip (send them the settings link).",
   "Every response is stamped `account: <slug>` \u2014 if that is not the account the user expects, stop and fix the connection before doing any work.",
   "Features are given account by account: awesomate_get_context carries `features` ({contacts, email, knowledge, agents, ...}, each {available, reason, message}). Never offer or start work in a feature whose `available` is false; say its message in one line and stop. No `features` block (an older hub) or no entry for a feature means carry on as before: never infer unavailable. A tool for such a feature answers feature_unavailable with the same sentence: never retry it, and never switch anything back on for the user.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,11 @@
 {
   "versions": [
+    {
+      "version": "0.74.0",
+      "highlights": [
+        "Claude knows 1Brain: how each person connects their own 1Brain in the hub, when to use 1Brain's own Claude connector, the 1Brain node in your automations or an AI agent, and the rules it keeps (drafts first, your own words, links to every page it used). New guide: what the 1Brain node can do"
+      ]
+    },
     {
       "version": "0.73.0",
       "highlights": [

package/skill/awesomate-n8n/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: awesomate-n8n
-description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, or {slug}.awesomate.io. Reads and n8n Agents on every plan; building workflows needs Support Plus+. Companion to awesomate-hosting: same connection, same PAT.
+description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, the 1Brain node, or {slug}.awesomate.io. Reads and n8n Agents on every plan; building workflows needs Support Plus+. Companion to awesomate-hosting: same connection, same PAT.
 ---
 
 # Awesomate n8n — your automations from Claude Code
@@ -128,6 +128,7 @@ they're blocked on a restart.
 | Changing a LIVE workflow | [upgrade-loop.md](references/upgrade-loop.md) |
 | "What could I automate?" | [possibilities.md](references/possibilities.md) |
 | WordPress form → n8n | [wp-form-handler.md](references/wp-form-handler.md) |
+| **1Brain** in a workflow or agent: procedures, SOPs, policies, the `CUSTOM.oneBrain` node (check it is on the instance first). Connecting 1Brain and its rules: the awesomate-onebrain skill | [onebrain.md](references/onebrain.md) |
 | A designed page served BY n8n — form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
 | Expression syntax details | [vendor/expressions/](references/vendor/expressions/SKILL.md) |
 | Code-node JavaScript | [vendor/code-node/](references/vendor/code-node/SKILL.md) |

package/skill/awesomate-n8n/references/onebrain.md

@@ -0,0 +1,224 @@
+# The 1Brain node: workflows and AI agents that use 1Brain
+
+1Brain (Business Blueprint) holds the business's systems: policies, procedures
+(SOPs), training courses, quizzes and acknowledgements. The 1Brain node reads
+and writes them from a workflow, or gives an AI Agent node tools to answer from
+them. For what 1Brain is, connecting it, and the rules that apply on every
+route (drafts, explicit account, never invent SOP content, page links in every
+answer), load the **awesomate-onebrain** skill too.
+
+## 0. Before you design anything
+
+1. **`features.onebrain`** in `awesomate_get_context`: `available: false` means
+   say its `message` in one line and stop.
+2. **Is the node on this instance?** It ships in fleet image
+   `2.41.4-awesomate.10` and later, which only some instances run so far; the
+   rest get it with the next fleet image. Check:
+   - `awesomate_n8n_inspect {what:'credentials'}`: a `oneBrainApi` credential
+     ("1Brain - <person>") means the node is there (the hub can only place it on
+     an instance that knows the type).
+   - `awesomate_n8n_inspect {what:'nodes'}`: `CUSTOM.oneBrain` or
+     `CUSTOM.oneBrainTool` already in use means it is there.
+   - Neither: assume it is not, or ask Awesomate support whether the account's
+     n8n has the 1Brain node yet. Say
+     so, and offer the MCP Client Tool route (section 6), which needs only
+     core n8n (not yet proven end to end: say so).
+3. **Whose credential?** Each person who connected 1Brain in the hub has their
+   own "1Brain - <person>" credential. No credential: they connect first
+   (hub Settings, Integrations, 1Brain). For an agent, use the credential of
+   the person the agent answers to (its supervisor): the agent can never see
+   more than that person.
+4. **Validation false positive:** `awesomate_n8n_deploy {action:'validate'}`
+   and `awesomate_n8n_node_docs` do not know CUSTOM nodes and report the 1Brain
+   node as unknown. Expected; do not "fix" it. The node catalog has no schema
+   for it either: this page is the reference.
+
+## 1. Node types and credentials
+
+| | |
+|---|---|
+| Regular node | `CUSTOM.oneBrain` |
+| AI Agent tool | `CUSTOM.oneBrainTool` (connect to the agent's `ai_tool` input) |
+| typeVersion | `2` for anything new. Version 1 exists only so old workflows open |
+| Authentication `accessToken` (default) | Credential `oneBrainApi` (fields `accessToken`, `baseUrl`). Made and kept current by the hub, one per person. Never create or edit it |
+| Authentication `oAuth2` | Credential `oneBrainOAuth2Api`: n8n signs in to 1Brain itself. Only for n8n instances the hub does not manage |
+| Base URL | `https://dev.1brain.io` until 1Brain's production connection is live. Only https `1brain.io`, `1brain.app` or `1brain.it` hosts are accepted |
+
+Parameters: `resource`, `operation`, `businessId` (the 1Brain account id, on
+every operation except Tool > Call, where it is optional), then the operation's
+own fields. Optional fields sit in `additionalFields`. A Page Search as an
+agent tool:
+
+```json
+{
+  "name": "Search procedures",
+  "type": "CUSTOM.oneBrainTool",
+  "typeVersion": 2,
+  "position": [600, 400],
+  "parameters": {
+    "authentication": "accessToken",
+    "businessId": 1234,
+    "resource": "page",
+    "operation": "search",
+    "query": "={{ $fromAI('query', 'Words to search the business procedures for', 'string') }}",
+    "limit": 5
+  },
+  "credentials": {
+    "oneBrainApi": { "id": "<id from awesomate_n8n_inspect credentials>", "name": "1Brain - Sam Taylor" }
+  }
+}
+```
+
+Get the account id from an Account > Get Many run (or the dropdown in the
+editor). Page Get takes `pageId` (a number). Department fields are
+`departmentId`, category fields `categoryId`; folder fields are a resource
+locator (`{ "__rl": true, "mode": "id", "value": "415331" }`, or `mode: "title"`).
+
+## 2. Operations
+
+| Resource | Operation (`resource` / `operation`) | What it does | Who can |
+|---|---|---|---|
+| Account | Get Many (`account` / `getMany`) | Accounts this connection may use, with their categories | anyone |
+| Account | Set Active (`account` / `setActive`) | Make an account the default. Rarely needed: the node names the account on every call | anyone |
+| Page | **Search** (`page` / `search`, the default) | Full-text search over titles, content and video transcripts, drafts included | anyone |
+| Page | Get (`page` / `get`) | One page: plain text, HTML, videos and transcripts | anyone with access |
+| Page | Get Many (`page` / `getMany`) | Every page in a department, folder or category, drafts included | anyone |
+| Page | Create (`page` / `create`) | A page in a department, optionally in a folder | editors |
+| Page | Update (`page` / `update`) | Title or description of a page or folder (not its contents) | its creator |
+| Page | Publish (`page` / `publish`) | Publish the latest draft (policies go to review) | its creator |
+| Page | Publish Many (`page` / `publishMany`) | Every unpublished page in a scope, 25 per call | its creator |
+| Page | Share (`page` / `share`) | Turn on public sharing and return the link | its creator |
+| Page | Add Tags (`page` / `addTags`) | Add tags to a page or folder (folder tags reach its pages) | editors |
+| SOP | Save (`sop` / `save`) | Save SOP or policy HTML you wrote, as a new page or a new version | editors |
+| SOP | Create Many (`sop` / `createMany`) | Up to 25 SOP or policy pages in one call | editors |
+| SOP | Tailor (`sop` / `tailor`) | Fit existing pages to the business (find and replace rules, or rewritten HTML) | editors |
+| SOP | Get Tailor Progress (`sop` / `getTailorProgress`) | Status of a background tailoring run | anyone |
+| SOP | Cancel Tailor (`sop` / `cancelTailor`) | Stop a background tailoring run | editors |
+| Category | Get Many (`category` / `getMany`) | Categories, and whether each has a business description | anyone |
+| Category | Create (`category` / `create`) | A category, private to its creator until shared | editors |
+| Department | Get Many (`department` / `getMany`) | Departments, optionally in one category | anyone |
+| Department | Create (`department` / `create`) | A department in a category | editors |
+| Department | Update (`department` / `update`) | Name, description, cover | editors |
+| Folder | Create (`folder` / `create`) | A folder in a department | editors |
+| Image | Upload (`image` / `upload`) | PNG or JPEG (up to 8 MB) from binary data; returns an upload id | editors |
+| Image | Add to Page (`image` / `addToPage`) | Put an image at the end of a page | the page's creator |
+| Image | Set Department Cover (`image` / `setDepartmentCover`) | Use an image as a department's cover | editors |
+| Course | Get Many, Get (`course` / `getMany`, `get`) | Courses and their lessons | anyone who can see them |
+| Course | Create (`course` / `create`) | A **published** course from a category, department, folder or chosen pages | owners, admins |
+| Quiz | Get Many, Get (`quiz` / `getMany`, `get`) | Quizzes and each member's results | owners, admins |
+| Quiz | Create, Delete (`quiz` / `create`, `delete`) | Add a quiz you wrote to a page, or remove it | owners, admins |
+| Read Marker | Get Many, Get (`readMarker` / `getMany`, `get`) | Acknowledgements and who completed them | owners, admins |
+| Read Marker | Create, Delete (`readMarker` / `create`, `delete`) | Add or remove an acknowledgement on a page | owners, admins |
+| Team Member | Get Many (`teamMember` / `getMany`) | Members with name, email and role | owners, admins |
+| Tool | Call (`tool` / `call`) | Any 1Brain tool by name (`toolName`) with JSON arguments (`toolArguments`) | depends on the tool |
+
+Search options (`searchOptions`): **Include Content** (`includeContent`: adds
+each hit's page text, one extra request per hit), **Limit to Department**
+(`department`), **Limit to Folder** (`folder`), and Status and Type filters on
+the results. Results carry `id`, `title`, `type`, `status` and `url`; every
+answer built from a page ends with its `url`. Search ids come back as strings;
+Page Get takes a number (`={{ Number($json.id) }}`).
+
+## 3. Behaviour to design around
+
+- **Drafts by default.** Every write that takes a status defaults to Draft in
+  the node (1Brain itself defaults to Published). Publish with Page > Publish,
+  only when the person asked.
+- **The account is always explicit.** The node sends it on every call;
+  otherwise 1Brain uses (and changes) the connection's active account.
+- **Permissions are 1Brain's.** A run sees and changes only what the connected
+  person can. Update, Publish, Share and Add to Page need the page's creator.
+- **60 requests a minute per person**, shared by every workflow and agent on
+  that person's credential. The node retries a 429 itself. Prefer one Get Many
+  over many Gets; turn Include Content on only for a few hits.
+- **Errors are plain.** Access switched off by the 1Brain account's owner
+  arrives as an error, not a sign-in problem: never "fix" it by reconnecting.
+  401 means the person connects again in the hub. A login page means the
+  credential is not signed in. An old operation says "This 1Brain operation was
+  retired. Open the node and pick a new one."
+- **1Brain never writes content.** You (or an LLM step working from the owner's
+  material) write the HTML. A category with no business description makes the
+  SOP operations stop and ask for one (`business_description`); SOP Save asks
+  which template to follow (`sop_template_source`: `1brain` or `user`). Pass
+  the owner's own words, never invented ones.
+- **Tags cannot be read** and **search cannot filter by tag**. Use Limit to
+  Department or Limit to Folder.
+- **Search ranking is loose and returns titles only.** For answers, search,
+  then read the top pages with Page Get.
+
+## 4. Patterns
+
+### An agent that answers from the business's procedures
+
+Chat Trigger (or a channel) → AI Agent with two `CUSTOM.oneBrainTool` tools,
+both on the supervisor's credential and the same `businessId`:
+
+1. **Search procedures**: Page > Search, `query` from `$fromAI`, `limit` 5.
+2. **Read a procedure**: Page > Get, `pageId` from
+   `$fromAI('pageId', 'The id of a page from Search procedures', 'number')`.
+
+System message (adapt, keep the rules): "Answer only from the business's
+procedures in 1Brain. Search first, then read the most relevant pages before
+answering. If nothing relevant is found, say you couldn't find a procedure for
+it and suggest who to ask; never guess. End every answer with the links (url)
+of the pages you used." Add the hat's `instructionLine` from
+`awesomate_business_map` when the agent helps a hat. Read-only by design: give
+it no write operations unless the owner asks for that, and then make writes
+Draft. Test with a question the procedures answer and one they do not.
+
+### A form or email turned into an SOP draft
+
+Trigger (form, email, Slack message) → an LLM step that turns the person's
+notes into SOP HTML **using only what they wrote**, marking gaps as questions →
+1Brain **SOP > Save** (scope department, `status` draft; or Page > Create with
+`status: draft`) → tell the owner, with the page link, that a draft is waiting
+for review. Run Category > Get Many once while designing: a category with no
+business description needs one from the owner before SOP Save works.
+
+### A weekly report of unpublished drafts
+
+Schedule Trigger → Department > Get Many → Page > Get Many per department
+(scope department: one request each, not one per page) → keep `status: draft`
+→ one email or message listing each draft's title and link, grouped by
+department. See [recurring-reports.md](recurring-reports.md) for the delivery
+side. Ten departments is ten requests: well inside 60 a minute.
+
+### Anything not in the operation list
+
+Tool > Call with the 1Brain tool's name (the dropdown lists them live) and its
+arguments as JSON. Use it sparingly and keep writes as drafts.
+
+## 5. Old 1Brain workflows (version 1)
+
+Some accounts have workflows from the earlier, pre-Awesomate 1Brain node (one
+action, "Search 1Brain"). They open as version 1, Page > Search, with the
+account (`businessId`) and `query` kept and page text added by default, as
+before. To bring one back to life:
+
+1. Reconnect: pick the person's hub-made "1Brain - <person>" credential. Old
+   credentials cannot reach 1Brain's new connection.
+2. **Remove the tags.** Search can no longer filter by tag, so a version 1 node
+   with tags stops with a clear message rather than searching the whole
+   account. Use Limit to Department or Limit to Folder instead.
+3. Check the account: an old `businessId` may be a production 1Brain account
+   that the development server (today's only connection point) does not have.
+4. Any other old operation says "This 1Brain operation was retired": pick a new
+   one in the node.
+
+Change a live workflow through the upgrade loop
+([upgrade-loop.md](upgrade-loop.md)), never in place.
+
+## 6. The no-code route: MCP Client Tool
+
+For an AI Agent that needs every 1Brain action with no node setup: n8n's own
+MCP Client Tool (`@n8n/n8n-nodes-langchain.mcpClientTool`; resolve its
+parameters with `awesomate_n8n_node_docs`) with the **MCP OAuth2** credential
+(`mcpOAuth2Api`), server address `https://dev.1brain.io/mcp`. The person
+creates and signs in to the credential on their n8n (it is an OAuth sign-in,
+so it is always finished in the browser). n8n 2.41.4's own source supports
+it (dynamic client registration, PKCE, rotating refresh tokens), but it has
+**not been run end to end yet**: tell the person it is untested, and test it
+with them before anyone relies on it. Each reconnect
+registers a new 1Brain connection, and the agent can use every tool the person
+can, writes included, so its system message must carry the rules above
+(drafts, confirm, never invent, links).

package/skill/awesomate-onebrain/SKILL.md

@@ -0,0 +1,196 @@
+---
+name: awesomate-onebrain
+description: Use the business's 1Brain (Business Blueprint's home for its systems) from Claude Code, its automations and its AI agents. Use when the user mentions 1Brain, Business Blueprint, "our systems", SOPs, policies, procedures, "what's our procedure for", "how do we do X here", "write this up as an SOP", "connect 1Brain", the 1Brain node in n8n, an agent that answers from our procedures, training courses, quizzes, acknowledgements or read markers. Covers connecting 1Brain in the hub, the three ways to use it and when to pick each, and the safety rules. Companion to awesomate-n8n (workflows and agents with the 1Brain node) and awesomate-hosting (the business map). Same connection, same PAT.
+---
+
+# 1Brain: the business's systems, from Claude Code
+
+1Brain (from Business Blueprint) is where a business keeps its systems: its
+policies, procedures (SOPs), training courses, quizzes and acknowledgements.
+Most people asking about it are business owners and their teams, not
+developers. Use plain words: "your procedures in 1Brain", "your systems",
+never "MCP", "OAuth" or "JSON-RPC" unless they use them first.
+
+**Routing rule:** what 1Brain holds comes from 1Brain itself (its own
+connector, or the 1Brain node in a workflow). What Awesomate set up (the
+connection, the credential, the feature) comes from the Awesomate tools.
+Never answer "what's our procedure for X" from memory or general knowledge.
+
+## How 1Brain is organised
+
+| 1Brain word | What it is | Watch out for |
+|---|---|---|
+| Account (1Brain's code calls it organization) | One business's 1Brain | A person can belong to several. Always name the one you mean |
+| Category (some accounts call it "Organization") | A top-level group of departments | Two categories can share a name: pick by id |
+| Department | A part of the business, such as Marketing or Finance | Matches a division on the business map |
+| Folder | A small topical group of pages in a department | Titles are unique within a department |
+| Page (System, SOP, policy) | One procedure or policy | Has a status: draft, published or for review |
+
+## 0. First (every session)
+
+1. `awesomate_whoami`: the account this folder is connected to. Wrong slug:
+   stop and fix the connection first.
+2. `awesomate_get_context` and read `features.onebrain`:
+   - `available: false`: say its `message` in one line and stop. Never offer
+     1Brain work, never explain how to switch it on, never retry.
+   - No `features` block, or no `onebrain` entry (an older hub): carry on, never
+     read that as unavailable.
+3. Work out which of the three ways below fits the ask before doing anything.
+
+## 1. Connecting 1Brain (in the hub, per person)
+
+Each person connects their **own** 1Brain login. Send them to the hub:
+**Settings, Integrations, 1Brain** (`https://hub.awesomate.ai/settings?tab=integrations`),
+then **Connect 1Brain**.
+
+- They sign in on 1Brain's own page and tick the 1Brain accounts to allow.
+  Awesomate never sees their 1Brain password.
+- The owner and team members with full access can connect. Each connection is
+  that person's: it sees exactly what they can see in 1Brain, no more.
+- The hub then puts a credential named **"1Brain - <their name>"** in the
+  account's automations (n8n) for the 1Brain node, and keeps it current.
+  Nobody pastes a token. Connecting also switches on "Build and change
+  automations from Claude Code" (Settings, Privacy), because that is what lets
+  the hub place the credential.
+- "Your automations don't have the 1Brain node yet": the connection worked,
+  but their n8n is on an older version. The credential arrives when the node
+  does. Nothing for them to do.
+- To allow another 1Brain account later: **Connect again** and tick it.
+- **Disconnect** forgets the sign-in and removes the credential (automations
+  using it stop reading 1Brain). 1Brain has no way for Awesomate to withdraw
+  its permission, so the hub links each 1Brain account's own MCP settings page
+  where they remove it.
+
+You cannot connect 1Brain for them, and no Awesomate tool reads or changes the
+connection. Never ask for a 1Brain token or password in chat.
+
+**Today 1Brain's connection point runs only on 1Brain's development server
+(`dev.1brain.io`).** `1brain.io` and `staging.1brain.io` do not offer it yet.
+Until they do, a connection reaches 1Brain's development server, not the
+1Brain the team signs in to every day. Say so if their pages "are missing".
+
+## 2. Three ways to use 1Brain, and which to pick
+
+| They want | Use |
+|---|---|
+| Claude (Claude Code, Claude.ai) to look things up or write in 1Brain, in a chat | **1Brain's own Claude connector** (2a) |
+| A workflow step that reads or writes 1Brain: a scheduled report, a form or email turned into an SOP draft, a sync | **The 1Brain node** with the hub-made "1Brain - <person>" credential (2b) |
+| An AI agent in their automations that answers from their procedures | **The 1Brain node as an agent tool** (`CUSTOM.oneBrainTool`: Page Search, then Page Get), on the credential of the person the agent answers to (2b) |
+| An AI agent that needs every 1Brain action, with no setup in the node | **MCP Client Tool** with n8n's own MCP OAuth2 credential (2c) |
+| Something done as the business rather than as a person | **Not possible yet.** Every 1Brain connection is a person |
+
+### 2a. Claude working directly in 1Brain
+
+1Brain has its own connector for Claude at `https://dev.1brain.io/mcp`
+(the development server, see above). The person adds it themselves:
+
+- Claude Code: `claude mcp add --transport http onebrain https://dev.1brain.io/mcp`,
+  then run `/mcp` in Claude Code and sign in to 1Brain.
+- Claude.ai: Settings, Connectors, Add custom connector, with that address.
+
+It signs in as them and asks which 1Brain accounts to allow. The Awesomate MCP
+has no 1Brain tool of its own: if 1Brain's tools are not in this session,
+never pretend to search 1Brain. Offer to set up the connector, or build a
+workflow that does it.
+
+When 1Brain's tools are in the session: confirm which account first (1Brain's
+own instructions ask this too), pass it on every call, search, then read the
+page before answering. 1Brain search returns titles only, and ranks loosely,
+so read the top few pages, not just the first.
+
+### 2b. Workflows and agents: the 1Brain node
+
+The node is in the account's n8n as `CUSTOM.oneBrain` (and `CUSTOM.oneBrainTool`
+for AI agents), on the hub-made credential. Load the **awesomate-n8n** skill and
+read its [references/onebrain.md](../awesomate-n8n/references/onebrain.md) for
+the operations, the parameters and tested patterns. The node is only on some
+instances so far: check before designing around it (that reference says how).
+
+### 2c. The no-code agent route
+
+n8n's own **MCP Client Tool** on an AI Agent, with an **MCP OAuth2** credential
+whose server address is `https://dev.1brain.io/mcp`. The person signs in from
+their n8n. It gives the agent every 1Brain tool with no setup, but each
+reconnect registers a new 1Brain connection, and the agent can do anything the
+person can, so give it strict instructions. n8n's own code supports this
+route, but it has not been run end to end yet: say it is untested and test it
+with them before anyone relies on it. Prefer 2b when the agent only needs to
+read procedures.
+
+## 3. Rules (every route)
+
+1. **Drafts by default.** Anything written to 1Brain goes in as a draft (the
+   node defaults to Draft, although 1Brain itself defaults to Published).
+   Publishing is a separate, deliberate step the person asks for.
+2. **Name the account every time.** A person can belong to several 1Brain
+   accounts. Ask which one if it is not obvious, then use it on every call.
+3. **Write only when asked.** Reading is fine whenever it helps. Creating,
+   changing, publishing, sharing, tagging or tailoring pages happens only when
+   the person asks for it.
+4. **Confirm before writing more than one page.** Say how many pages, which
+   department, and draft or published, and wait for a yes. Bulk tools (Create
+   Many, Publish Many, Tailor) also ask 1Brain's own confirm step: never tick
+   it for them.
+5. **Never invent SOP content.** 1Brain never writes content: what goes in a
+   page comes from the owner's own words, documents or answers. Where a step is
+   missing, leave a clear gap and ask. Never fill it with a plausible guess.
+6. **End every answer built from 1Brain with the page links** (each result's
+   `url`), so the person can check the source.
+7. **Nothing found is an answer.** "I couldn't find a procedure for that in
+   your 1Brain" beats a made-up one. Offer to draft one from their words.
+8. **60 requests a minute per person,** shared by every workflow and agent on
+   that person's connection. Prefer one list over many single reads; never
+   loop page by page over a whole account.
+9. **Permissions are the person's own.** A connection sees and changes only
+   what that person can in 1Brain. Some actions (update, publish, share, add an
+   image to a page) only work on pages that person created.
+10. **An agent can never see more than the person it answers to.** An agent
+    on its supervisor's credential is capped at that supervisor's access.
+    Never put an agent on a more senior person's credential to "give it more".
+
+## 4. Writing an SOP or policy
+
+1. Gather the owner's own material: their notes, a recording transcript, an
+   existing document, or answers to a few short questions.
+2. Write the page as HTML in their voice (`awesomate_business` for the
+   business's name and voice). Mark anything you could not confirm.
+3. Show it to them. Save it as a **draft** in the department they choose.
+4. 1Brain may stop and ask for two things first: a **business description**
+   for the category (what the business does, who its customers are, where it
+   works; take it from the owner, never invent it) and **which template to
+   follow** (1Brain's SOP template or their own).
+5. Publishing is a separate yes. Policies go to review rather than straight
+   to published.
+
+## 5. Training: courses, quizzes, acknowledgements
+
+Owners and admins can list and read courses, quizzes and who passed them,
+and acknowledgements (read markers: "I have read and understood this page")
+and who completed them; members can read courses. Creating a course
+publishes it, so confirm first. A quiz or acknowledgement is added to one
+page; confirm by name before deleting one.
+
+## 6. Known gaps (say so plainly)
+
+- **Tags cannot be read.** 1Brain returns pages without their tags, and has no
+  way to list them. Tags can be added, not read back or removed.
+- **Search cannot filter by tag** (or by department or folder). In a workflow,
+  use the node's Limit to Department or Limit to Folder instead.
+- So a hat's procedures linked by its 1Brain tag on the business map
+  (`job:<slug>`, from `awesomate_business_map`) cannot be fetched by tag yet:
+  find them by department, folder or search.
+- No deleting or moving pages, folders, departments or categories through any
+  route. That is done in 1Brain itself.
+- Nothing can run as the business itself: every connection is a person.
+
+## 7. When something goes wrong
+
+| What they see | What it means | What to do |
+|---|---|---|
+| "1Brain access is switched off for you" | The 1Brain account's owner turned off Claude and automation access for them (or for the whole account) | Only that owner can turn it back on, in 1Brain's settings. Never reconnect to "fix" it |
+| "Sign in again" / 401 | The connection has lapsed | Connect again in Settings, Integrations, 1Brain |
+| A login page instead of data | The credential is not signed in | The same: connect again |
+| "This 1Brain operation was retired" | An old (pre-Awesomate) 1Brain step | Open the node and pick a new operation (awesomate-n8n onebrain.md, old workflows) |
+| "Your automations don't have the 1Brain node yet" | Their n8n is on an older version | Nothing to do; it arrives with the next update |
+| Too many requests | The 60 a minute is used up across their workflows and agents | Wait a minute; spread the work out |
+| Pages they expect are missing | Not shared with them in 1Brain, the wrong account, or the development-server note above | Check the account, then their access in 1Brain |